3

There are times as a system administrator, you might not be sure of the log file paths of a new application. Depending on the system, there may be multiple ways to find the same. Please share the different ways we can get a list of open log files on a system.

  • 1
    Beware that applications which log via syslog will not open (or appear to be using) a log file. – goldilocks Oct 11 '13 at 15:42
  • @goldilocks - is there anyway we can identify these apps? I guess syslog would be a path that we could grep? – Kent Pawar Oct 11 '13 at 16:17
  • 3
    Syslog is a system service traditionally implemented by syslogd but more recently by rsyslogd and some other things. In any case, applications using this will log things via a system call; beyond reading the documentation, there would be no way to tell until they log something. If you do not understand what syslog is in a unix-like context and you are asking this kind of question, you had better do some catch up reading and research ASAP, because this is mission critical knowledge! – goldilocks Oct 11 '13 at 18:04
3

User X files

If you need to see just a single user's open files:

$ lsof -u<user>

Or only files with a text file descriptor (typically real files):

$ lsof -a -u<user> -d txt

Example

All files in use by user saml.

$ lsof -usaml
COMMAND     PID USER   FD   TYPE             DEVICE  SIZE/OFF       NODE NAME
vim        1341 saml  cwd    DIR              253,2      4096   10370078 /home/saml/mp3s
vim        1341 saml  rtd    DIR              253,0      4096          2 /
vim        1341 saml  txt    REG              253,0   2105272    1215334 /usr/bin/vim
vim        1341 saml  mem    REG              253,0    237616     393586 /lib64/libgssapi_krb5.so.2.2

Only files using a text descriptor and are owned by user saml.

$ lsof -a -usaml -d txt
      Output information may be incomplete.
COMMAND     PID USER  FD   TYPE DEVICE SIZE/OFF     NODE NAME
vim        1341 saml txt    REG  253,0  2105272  1215334 /usr/bin/vim
bash       1468 saml txt    REG  253,0   940312  2490450 /bin/bash
gvfsd-htt  1777 saml txt    REG  253,0   179528  1209465 /usr/libexec/gvfsd-http
gnome-key  2051 saml txt    REG  253,0   953664  1214068 /usr/bin/gnome-keyring-daemon
...

lsof as root

Typically though you'll want to run lsof with elevated privileges so you can see all the files on a system owned by an Apache process or root, for example.

$ sudo lsof  

You can also use lsof backwards and find out what process opened a particular file.

$ sudo lsof /var/log/messages
      Output information may be incomplete.
COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
rsyslogd 1266 root    4w   REG  253,0   372306 1973825 /var/log/messages

lsof as top

You can also use lsof similarly to top where it will poll every number of seconds and show you what's going on on your system.

$ sudo lsof -u saml -c sleep -a -r5

Example

The -c ... argument only shows processes with the string ... in their name. Here I'm using the command sleep to show this. I run the lsof command which polls every 5 seconds, and shows any files opened by any processes with the string sleep in them. I then ran sleep 5 in another terminal.

$ sudo lsof -u saml -c sleep -a -r5
      Output information may be incomplete.
=======
=======
=======
=======
COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF     NODE NAME
sleep   10780 saml  cwd    DIR  253,2    32768 10354689 /home/saml
sleep   10780 saml  rtd    DIR  253,0     4096        2 /
sleep   10780 saml  txt    REG  253,0    27912  2490470 /bin/sleep
sleep   10780 saml  mem    REG  253,0   151456   393578 /lib64/ld-2.13.so
sleep   10780 saml  mem    REG  253,0  1956608   393664 /lib64/libc-2.13.so
sleep   10780 saml  mem    REG  253,0 99158752  1209621 /usr/lib/locale/locale-archive
sleep   10780 saml    0u   CHR 136,59      0t0       62 /dev/pts/59
sleep   10780 saml    1u   CHR 136,59      0t0       62 /dev/pts/59
sleep   10780 saml    2u   CHR 136,59      0t0       62 /dev/pts/59
=======
=======
=======
=======

log files

You can use lsof to find log files by simply grepping any of the above output for the names of the log files that you're interested in seeing what's going on with.

$ lsof .... | grep "log file name"
  • Thank you! The 'text file descriptor' filter is definitely an efficient way of searching for text log files – Kent Pawar Oct 11 '13 at 15:20
  • 1
    @KentPawar - yeah poke around the man page for lsof, there is a lot of other things you can do with it. – slm Oct 11 '13 at 15:24
1

On Solaris 10 and Solaris 11

Use the pfiles command to see the files that a process has open, including log files. Grep on the output and you'll be able to see if the process (at the time of your snapshot) has a log file open.

As for the other answers on this page:

On Solaris there's no such thing as pstree or lsof out-of-the-box.

  • pstree. This tool is found on most Linux'es. It is actually very similar to the Solaris ptree command, in fact I've read somewhere that pstree was inspired from Solaris ptree. I'm sure you can make pstree work on Solaris but I'm not sure I would understand the point of it when you have the ptree command ??

  • lsof. This tool is not natively available on Solaris. True that you can find it but last time I looked it used an undocumented hack to do its tricks on Solaris. Also it only worked on global zones last time I looked. The Solaris closest equivalent would be pfiles.

1

I use the below to get a system-wide list of open .log files:

lsof | grep "\.log$" | awk '{print $NF}' | sort -u

To get a list of .log files for a process I use:

pfiles <PID> | grep "\.log$" | sort -u

Also, please let me know if there is a more efficient way of doing this..

  • Shouldn't your awk be awk '{print $NF}' ? – Runium Oct 11 '13 at 13:41
  • If all you know about a log file is that it is named *.log, then I'm afraid you can't really find anything more efficient than a system-wide lsof. – peterph Oct 11 '13 at 13:44
  • Just checked the man page - NF: number of fields in the current record. So is it better to use $NF in place of $9 (9th field has list the files on my system) in case the number of fields change across implementation..? – Kent Pawar Oct 11 '13 at 13:47
  • 1
    @KentPawar: Yes, and the number of fields can vary. E.g. if TID is present then it becomes $10 and not $9. Best to use the -F option. Section: OUTPUT FOR OTHER PROGRAMS in man. E.g. lsof -F n | awk '/\.log$/{print}' | .... – Runium Oct 11 '13 at 15:08
  • Thanks @Sukminder. I have updated my answer to reflect this. – Kent Pawar Oct 11 '13 at 15:17
-1

You can use locate. For example:

locate .log
  • 1
    An explanation of what locate does, and the pitfalls of running this command would improve this answer (and would avoid it getting deleted) – Drav Sloan Aug 11 '15 at 11:14
  • And posting an answer as a question improves the chance of it getting deleted. For questions use comments. As long as you don't have the reputation, don't abuse answer boxes to pose questions, and work on getting enough reputation. Some question can be reworded as "If xyz works, then ..." – Anthon Aug 11 '15 at 17:11
  • locate would find all files matching the pattern; the question is looking for open files – Michael Mrozek Aug 11 '15 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.